PT-2009-1002 · Dnsmasq+1 · Dnsmasq+1
Steve
·
Publicado
2009-08-31
·
Atualizado
2017-09-19
·
CVE-2009-2958
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
dnsmasq versions prior to 2.50
Description
The issue allows remote attackers to cause a denial of service, resulting in a daemon crash due to a NULL pointer dereference. This can be achieved by sending a TFTP read request with a malformed
blksize option. The vulnerability can be exploited when the --enable-tftp option is used.Recommendations
For versions prior to 2.50, update to version 2.50 or later to resolve the issue. As a temporary workaround, consider disabling the
tftp request function or restricting the use of the TFTP service until a patch is available. Avoid using the blksize option in TFTP read requests until the issue is resolved.Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Red Hat
Dnsmasq